Security, in plain terms
DevAudit is a small independent project and doesn't hold formal security certifications. Here is what it actually does to protect your tokens, secrets and code.
Secrets are encrypted at rest
GitHub access tokens and saved environment variables are encrypted with AES-256-GCM before they are stored. Environment variables are decrypted on our servers only at the moment you deploy. Traffic to and from the Service uses HTTPS (TLS).
API tokens are stored as hashes
We keep only a SHA-256 hash of each API token, plus its name and a short prefix. The full token is shown once, when you create it, so it can't be read back out of our database.
Your GitHub token stays on the server
The token is stored encrypted and is never sent to your browser. The dashboard talks to GitHub through a server-side proxy that only allows a fixed list of GitHub API calls.
GitHub access, explained
Sign-in requests GitHub's repo permission, which is broad: GitHub's sign-in scopes don't offer a narrower option for private repositories. DevAudit reads your repositories and, only when you ask, creates branches and commits, creates repositories or changes a repository's visibility. You can revoke access at any time in your GitHub settings.
AI features send code to third parties
AI explanations, fixes and the assistant send the code excerpts and prompts you submit to AI providers (currently OpenRouter and Groq), some of them on free tiers that may log inputs. Environment variable values are never included in deployment recommendations. Please don't put secrets in prompts. See the Privacy Policy for details.
Abuse protection
API and AI endpoints are rate limited, and deploy webhooks can only point at public HTTPS addresses, so the Service can't be aimed at internal networks.
You control your data
Delete projects, environment variables and API tokens from the dashboard, or disconnect DevAudit in your GitHub settings. Data is kept until you delete it or ask us to, as described in the Privacy Policy.